ForHosting KIT · Developer Utilities

Generate a 2FA code

The six-digit code your authenticator app refreshes every 30 seconds is math, not magic: a shared secret and the current time, hashed together. This API performs that same calculation server-side, letting you generate a valid code for a secret or verify a code a user just typed in, without embedding TOTP logic in every service that needs two-factor authentication.

● StableFree · in your browser

Run — free How it works & API

Use it from WebAPIEmailApp soonTelegram soon

The problem this solves

Two-factor authentication built on time-based codes needs the same computation done in at least two places: once inside the user's authenticator app, and once on your server to check what they typed. Reimplementing that logic correctly, especially the time-window tolerance for clock drift between a phone and a server, is easy to get subtly wrong, and a subtly wrong TOTP implementation either locks legitimate users out or, worse, accepts codes it shouldn't. Centralizing the calculation removes that class of bug entirely.

What actually happens on each call

POST /dev/totp with a base32 secret and, depending on the operation, either a request to generate the current valid code or a code to verify against that secret. The API runs the task asynchronously, returns a task_id immediately, and delivers the generated code or the verification verdict by signed webhook or a signed link valid for 24 hours, along with the time window it was evaluated against.

Where TOTP came from

Time-based One-Time Password was standardized in RFC 6238 in 2011, building directly on the earlier HOTP counter-based standard from RFC 4226. Swapping an incrementing counter for the current Unix time, divided into 30-second steps, solved HOTP's biggest practical problem: counters drift out of sync when a code is generated but never used, while time resynchronizes itself automatically every interval. That's why virtually every authenticator app you've ever scanned a QR code into speaks TOTP, not HOTP.

How it fits into a real auth flow

This endpoint is called from backend login flows validating the six-digit code a user submits after their password, from account-setup flows generating a test code to confirm a user scanned their QR code correctly before 2FA is turned on, from support tools that need to verify a code during an account-recovery call, and from automated test suites that need a valid code to log in as a test account without a human present to type one.

What the response tells you

Verification returns a clear boolean plus the time step it matched against, since a small drift window is normal and expected. Generation returns the current code and its remaining validity in seconds. Malformed secrets are rejected immediately with a specific error, and since failed tasks are never billed, you can safely validate your secret format before wiring it into a live login flow.

What you can do with it

Login-time 2FA verification

Check the six-digit code a user enters after their password against their stored TOTP secret before granting access.

2FA onboarding confirmation

Generate the current code for a freshly created secret to confirm a user scanned their authenticator QR code correctly.

Account recovery support flows

Verify a code a customer reads over a support call against their account's secret during a recovery process.

Automated login testing

Generate a valid code on demand so CI test suites can log in as a 2FA-protected test account without manual intervention.

FAQ

What is a TOTP code and how does this API generate one?

It's a six-digit code derived from a shared secret and the current time; POST /dev/totp computes it the same way any authenticator app does.

Can this verify a code my user typed in?

Yes, send the code and the secret, and the API returns whether it matches within the accepted time window.

Is the TOTP API free to use?

The tool above runs free in your browser. The API is paid — each call draws from your prepaid ForHosting KIT balance: top up from $10.00 (it never expires), pay each request's published price, and a call with no balance returns HTTP 402. No subscription, no tokens, and a failed task is never charged.

How much does generating or verifying a code cost?

$0.002 per request for either operation, and a failed task, such as a malformed secret, is never charged.

Does this work with Google Authenticator and similar apps?

Yes, it follows the RFC 6238 standard that essentially every TOTP authenticator app implements, so codes match exactly.

How does clock drift get handled?

The API checks a small window of adjacent time steps, the same tolerance real authenticator apps rely on, so minor clock differences don't reject valid codes.

Do you store the secrets I send?

No, secrets are used only to process that single request and are deleted after the retention window, never used for training.

Can I use this for bulk 2FA testing?

Yes, submit as many separate generate or verify requests as you need; each is processed and billed independently.

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/dev/totp

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, and soon from our app, email and Telegram.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/dev/totp \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d &#39;{"items":["valor-1","valor-2"]}'

const res = await fetch("https://api.kit.forhosting.com/dev/totp", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "items": [
      "valor-1",
      "valor-2"
    ]
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/dev/totp",
    headers={"Authorization": f"Bearer {os.environ[&#39;KIT_KEY']}"},
    json={
    "items": [
        "valor-1",
        "valor-2"
    ]
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/dev/totp", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => &#39;{"items":["valor-1","valor-2"]}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"items":["valor-1","valor-2"]}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/dev/totp", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "items": [
    "valor-1",
    "valor-2"
  ]
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "dev.totp",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.002

Published price — no tokens, no invented credits. A failed task is never charged.

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.

Read the full KIT documentation →

Run — free